The purpose of this policy is regarding the processes of storage, deletion, destruction or anonymization of personal data processed by the Controller (Data Controller) wholly or partially automatically or by non-automatic means provided that it is part of any data filing system or by means intended to form part of a filing system. to determine the principles and procedures.

This Policy; It has been prepared in accordance with the “Regulation on the Deletion, Destruction or Anonymization of Personal Data” based on the third paragraph of Article 7 and the first paragraph of Article 22 of the Law No. 6698.

Data Controller; It has prepared this personal data storage and destruction policy in accordance with the personal data processing inventory.

This Policy covers Finso Finansal Teknoloji Çözümleri Anonim Şirketi, as the Data Controller, to inform about the following:

1.4.1 The purpose of the policy and the provisions of the underlying legislation, the implementation procedures within the Data Controller
1.4.2 Legal and technical terms and definitions included in the Personal Data Retention and Disposal Policy
1.4.3 Purposes and legal reasons for the storage of personal data
1.4.4 All kinds of recording media where Personal Data is recorded
1.4.5 Explanations on legal, technical or other reasons that require the retention and disposal of personal data
1.4.6 The technical and administrative measures taken by the Data Controller for the safe storage of personal data and the prevention of unlawful processing and access
1.4.7 Technical and administrative measures taken for the legal destruction of personal data
1.4.8 The titles, units and job descriptions of those involved in the storage and destruction of personal data
1.4.9 Table showing storage and disposal times
1.4.10 Periodic destruction times and methods of destruction
1.4.11 If the current personal data retention and destruction policy has been updated, information regarding the said change

2.1 Recipient Group: It is the natural or legal person category to which personal data is transferred by the data controller.
2.2 Relevant User: Persons who process personal data within the organization of the data controller or in line with the authorization and instruction received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of the data.
2.3 Destruction: It is the process of deletion, destruction or anonymization of personal data.
2.4 Recording Environment: It refers to any environment in which personal data is processed wholly or partially automatically or by non-automatic means provided that it is a part of any data recording system.
2.5 Electronic Media: Environments where personal data can be created, read, changed and written with electronic devices.
2.6 Non-Electronic Media: All written, printed, visual etc. other than electronic media. other environments.
2.7 Service Provider: A natural or legal person who provides services within the framework of a specific contract with the Data Controller.
2.8 Personal Data Processing Inventory: Personal data processing activities carried out by data controllers depending on their business processes; It is the inventory that they create by associating personal data with the processing purposes, data category, transferred recipient group and data subject group, and detailing the maximum period required for the purposes for which personal data is processed, the personal data to be transferred to foreign countries and the measures taken regarding data security.
2.9 Personal Data Retention and Disposal Policy: This is the policy on which data controllers base the process of determining the maximum time required for the purpose for which personal data is processed, and the process of deletion, destruction and anonymization.
2.10 Periodic Disposal: It refers to the deletion, destruction or anonymization process that will be carried out ex officio at repetitive intervals and specified in the personal data storage and destruction policy, in the event that all the conditions for processing personal data in the law are eliminated.
2.11 Registry: It refers to the registry of data controllers kept by the Presidency of the Personal Data Protection Authority.
2.12 Data Registration System: It refers to the registration system in which personal data is processed and structured according to certain criteria.
2.13 Data Controller: Refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. Deletion of Personal Data: Deletion of personal data is the process of making personal data inaccessible and unusable for the relevant users in any way.
2.14 Deletion of Personal Data: Deletion of personal data is the process of making personal data inaccessible and unusable for the relevant users in any way.
2.15 Destruction of Personal Data: Destruction of personal data is the process of making personal data inaccessible, unrecoverable and unusable by anyone in any way.
2.16 Anonymization of Personal Data: It is the rendering of personal data that cannot be associated with an identified or identifiable natural person under any circumstances, even if it is matched with other data. In order for personal data to be anonymized; Personal data must be rendered incapable of being associated with an identified or identifiable natural person, even by using appropriate techniques for the recording medium and the relevant field of activity, such as returning and matching the data with other data by the data controller, recipient or recipient groups.
2.17 Relevant Person: Refers to the natural person whose personal data is processed.
2.18 Explicit Consent: It refers to the consent that is based on information and freely expressed regarding a certain subject.
2.19 Personal Data Protection Commission: It means the commission established within the Data Controller and involved in the PDP Law processes (“PDP Law Commission”).

The Data Controller, all its units and employees, as well as the responsible implementation of the technical and administrative measures taken within the scope of the Policy, training and awareness of the unit employees, prevention of unlawful processing of personal data by monitoring and continuous inspection, prevention of unlawful access to personal data, and In order to ensure that personal data is kept in accordance with the law, it actively supports the responsible units in taking technical and administrative measures to ensure data security in all environments where personal data is processed.

The distribution of the titles, units and job descriptions of those involved in the storage and destruction processes of personal data is given in Table 1.

Table 1: Units in Storage Processes and Distribution of Duties

4.1 Paper Media:

• • Paper
  • Manual data recording systems (forms visitor entry book)
  • Written, printed, visual media

4.2 Electronic Media:

• • Servers (Domain, backup, email, database, web, file sharing, etc.)
  • Software
  • Information security devices (firewall, intrusion detection and prevention, log file, antivirus, etc.)
  • Personal computers (Desktop, laptop)
  • Mobile devices (phone, tablet, etc.)
  • Optical discs (CD, DVD, etc.)
  • Removable memories (USB, Memory Card etc.)
  • Printer, scanner, copier

5.1 Law No. 6698 on the Protection of Personal Data
5.2 Turkish Code of Obligations No. 6098
5.3 Public Procurement Law No. 4734
5.4 Civil Servants Law No. 657
5.5 Social Insurance and General Health Insurance Law No. 5510
5.6 Arrangement of Publications on the Internet No. 5651 and These Publications
5.7 Law on Combating Crimes Committed by
5.8 Public Financial Management Law No. 5018
5.9 Occupational Health and Safety Law No. 6331
5.10 Law on Access to Information No. 4982
5.11 Law No. 3071 on the Use of the Right to Petition
5.12 Labor Law No. 4857
5.13 Higher Education Law No. 2547
5.14 Retirement Health Law No. 5434
5.15 Social Services Law No. 2828
5.16 Regulation on Health and Safety Measures to be Taken in Workplace Buildings and Attachments
5.17 Regulation on Archive Services
5.18 Regulation on Personal Health Data
5.19 Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions
5.20 It is stored as long as the storage periods stipulated in the framework of other secondary regulations in force in accordance with these laws.

6.1 Execution of Emergency Management Processes
6.2 Execution of Information Security Processes
6.3 Execution of Employee Candidate/Intern/Student Selection and Placement Processes
6.4 Execution of Application Processes of Employee Candidates
6.5 Execution of Employee Satisfaction and Loyalty Processes
6.6 Fulfillment of Employment and Legislation Obligations for Employees
6.7 Execution of Benefits and Benefits Processes for Employees
6.8 Conducting Audit/Ethics Activities
6.9 Conducting Educational Activities
6.10 Execution of Access Authorizations
6.11 Execution of Activities in Compliance with the Legislation
6.12 Execution of Finance and Accounting Affairs
6.13 Execution of Company/Product/Services Loyalty Processes
6.14 Providing Physical Space Security
6.15 Execution of Assignment Processes
6.16 Follow-up and Execution of Legal Affairs
6.17 Conducting Internal Audit/Investigation/Intelligence Activities
6.18 Execution of Communication Activities
6.19 Planning of Human Resources Processes
6.20 Execution/Audit of Business Activities
6.21 Execution of Occupational Health/Safety Activities
6.22 Receiving and Evaluating Suggestions for Improvement of Business Processes
6.23 Conducting Business Continuity Ensuring Activities
6.24 Execution of Logistics Activities
6.25 Execution of Goods/Service Procurement Processes
6.26 Execution of Goods/Services After Sales Support Services
6.27 Execution of Goods/Service Sales Processes
6.28 Execution of Goods/Services Production and Operation Processes
6.29 Execution of Customer Relationship Management Processes
6.30 Execution of Activities for Customer Satisfaction
6.31 Organization and Event Management
6.32 Conducting Marketing Analysis Studies
6.33 Execution of Performance Evaluation Processes
6.34 Execution of Advertising/Campaign/Promotion Processes
6.35 Execution of Risk Management Processes
6.36 Execution of Storage and Archive Activities
6.37 Conducting Social Responsibility and Civil Society Activities
6.38 Execution of Contract Processes
6.39 Execution of Sponsorship Activities
6.40 Execution of Strategic Planning Activities
6.41 Follow-up of Requests/Complaints
6.42 Ensuring the Security of Movable Property and Resources
6.43 Execution of Supply Chain Management Processes
6.44 Execution of Wage Policy
6.45 Execution of Marketing Processes of Products/Services
6.46 Ensuring the Security of Data Controller Operations
6.47 Foreign Personnel Work and Residence Permit Procedures
6.48 Execution of Investment Processes
6.49 Execution of Talent/Career Development Activities
6.50 Providing Information to Authorized Persons, Institutions and Organizations
6.51 Execution of Management Activities
6.52 Creating and Tracking Visitor Records

7.1 Personal data; Amendment or repeal of the provisions of the relevant legislation, which are the basis for processing,
7.2 The disappearance of the purpose requiring its processing or storage,
7.3 In cases where the processing of personal data takes place only on the basis of express consent, the data subject withdraws his explicit consent,
7.4 In accordance with Article 11 of the Law, the application made by the Authority regarding the deletion and destruction of personal data within the framework of the rights of the person concerned,
7.5 In the event that the Institution rejects the application made by the person concerned with the request for the deletion, destruction or anonymization of his personal data, finds the answer insufficient or does not respond within the time stipulated in the Law;
7.6 Making a complaint to the Board and this request being approved by the Board,
7.7 In cases where the maximum period for keeping personal data has passed and there is no condition to justify keeping personal data for a longer period of time,
7.8 It is deleted, destroyed or ex officio deleted, destroyed or anonymized by the Data Controller upon the request of the person concerned.

8.1 Network security and application security are provided.
8.2 A closed system network is used for data transfers via the network.
8.3 Key management is implemented.
8.4 Security measures are taken within the scope of procurement, development and maintenance of information technology systems.
8.5 An authorization matrix has been created for employees.
8.6 Access logs are kept regularly.
8.7 Institutional policies on access, information security, use, storage and destruction have been prepared and started to be implemented.
8.8 Data masking method is applied when necessary.
8.9 Personal data security issues are reported quickly.
8.10 Personal data security is monitored.
8.11 Necessary security measures are taken regarding entry and exit to physical environments containing personal data.
8.12 The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
8.13 The security of environments containing personal data is ensured.
8.14 Personal data is backed up and the security of the backed up personal data is also ensured.
8.15 User account management and authorization control system are implemented and these are also followed.
8.16 In-house periodic and/or random audits are conducted and made.
8.17 Log records are kept without user intervention.
8.18 Existing risks and threats have been identified.
8.19 If sensitive personal data is to be sent via e-mail, it must be sent in encrypted form and using a KEP or corporate mail account.
8.20 Secure encryption/cryptographic keys are used for sensitive personal data and are managed by different units.
8.21 Intrusion detection and prevention systems are used.
8.22 Penetration test is applied.
8.23 Cyber security measures have been taken and their implementation is constantly monitored.
8.24 Encryption is done.
8.25 Data processing service providers are periodically audited on data security.
8.26 Awareness of data processing service providers on data security is provided.
8.27 Data loss prevention software is used.
8.28 There are disciplinary regulations that include data security provisions for employees.
8.29 Training and awareness activities are carried out periodically for employees on data security.
8.30 Institutional policies on access, information security, use, storage and destruction have been prepared and started to be implemented.
8.31 Confidentiality commitments are made.
8.32 The signed contracts contain data security provisions.
8.33 Extra security measures are taken for personal data transferred via paper and the relevant document is sent in confidential document format.
8.34 Personal data security policies and procedures have been determined.
8.35 The security of environments containing personal data is ensured.
8.36 Personal data is reduced as much as possible.
8.37 In-house periodic and/or random audits are conducted and made.
8.38 There are protocols and procedures for special quality personal data security.

9.1 Personal Data on Servers: The system administrator removes the access authorization of the relevant users and deletes the personal data on the servers for those whose period has expired.
9.2 Personal Data in the Electronic Media: The personal data in the electronic media, whose period of time has expired, is rendered inaccessible and non-reusable for other employees (related users) except the database administrator.
9.3 Personal Data in the Physical Environment: Personal data kept in the physical environment is rendered inaccessible and unusable in any way for other employees, except for the unit manager responsible for the document archive, for those whose period has expired. In addition, the process of blackening is applied by drawing/painting/erasing in a way that cannot be read.
9.4 Personal Data in Portable Media: Personal data kept in flash-based storage media, which require storage, are encrypted by the system administrator and the access authorization is given only to the system administrator, and are stored in secure environments with encryption keys.

10.1 Personal Data in the Physical Media: Personal data in the paper media, which need to be kept, are irreversibly destroyed in the paper clipping machines.
10.2 Personal Data in Optical/Magnetic Media: The physical destruction of personal data in optical media and magnetic media, such as melting, burning or pulverizing, is applied. In addition, magnetic media is passed through a special device and exposed to a high magnetic field, making the data on it unreadable.

11.1 Anonymization of personal data means that personal data cannot be associated with an identified or identifiable natural person, even by matching them with other data. The Company can anonymize personal data when the reasons that require the processing of personal data processed in accordance with the law are eliminated.
11.2 In accordance with Article 28 of the PDP Law; Anonymized personal data may be processed for purposes such as research, planning and statistics. Such processing is outside the scope of the PDP Law. Since personal data processed by anonymization will be outside the scope of the PDP Law, the rights set out in section 10 of the policy will not be valid for this data.
11.3 Masking: Data masking is a method of anonymizing personal data by removing the basic identifying information of personal data from the data set. Example: The name that enables the identification of the personal data owner, Turkish Citizenship Identity No, name, surname etc. converting the personal data into a data set where it becomes impossible to identify the owner of the personal data by extracting the information.
11.4 Aggregation: With the data aggregation method, many data are aggregated and personal data is rendered unrelated to any person. Example: Revealing that there are 100 customers born in 1975 without showing individual customer’s birth years.
11.5 Data Derivation: With the data derivation method, a more general content is created than the content of the personal data and it is ensured that the personal data cannot be associated with any person. Example: Specifying ages instead of birth dates; specifying the county or city of residence instead of the full address.
11.6 Data Shuffling – Permutation): With the data shuffling method, the values in the personal data set are mixed and the bond between the values and the individuals is broken. Example: Changing the quality of the voice recordings so that the voices and the data owner cannot be associated or recognized.
11.7 Removing Variables: Removing one or more parts of the data that can be used to associate personal data with a natural person

12.1 Destruction processes are carried out upon the request of the person concerned, the decision of the Personal Data Protection Board or the expiration of the periodical destruction period.
12.1.1 Periodic Disposal: Periodic destruction period determined by the Data Controller is December and June of each year.
12.1.2 Destruction at the Request of the Relevant Person: Upon the request of the relevant person, destruction is carried out without delay, if the request is deemed appropriate, and in any case within 30 days from the notification of the request, and the relevant person is answered within the same period. The application and request processes of the relevant person are specified in the “Relevant Person Application Procedure”.
12.1.3 Destruction Upon Board Decision: In case of a decision regarding the destruction of personal data by the Personal Data Protection Board, it is carried out without delay and in any case within 30 days from the notification of the decision, and the Board is replied within the same period.
12.2 In the table below, the categories of data processed within the Data Controller, the processing and storage periods required by the legal and processing purpose, and the destruction period are listed.
12.3 Destruction of personal data not included in this table but included in the processes of the Data Controller, or updating the table and adding it; The Committee on the Protection of Personal Data is authorized to decide, provided that it is proportional to the Board Decisions and the purpose of processing personal data. In its decision, the PDP Law Commission ensures that the period complies with the principles in Article 4 of the PDP Law.
12.4 These records are kept for at least three years, excluding other legal obligations.

Table 2: Table Showing Retention Periods and Destruction Times

The policy is published in two different media, with wet signature (printed paper) and electronically, and is disclosed to the public on the website.

The policy is reviewed as needed and the necessary sections are updated.

The policy is deemed to have entered into force after it is announced to the employees and published on the website of the Data Controller.

ANNEX-1: Disposal Memo Upon Relevant Person’s Request

ANNEX-2: Periodic Disposal Report